CVE-2023-51482 CRITICAL

CVE-2023-51482: WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability

Vendor Eazyplugins
Product Eazy Plugin Manager
Weakness CWE-287 · Improper authentication
Published April 25, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eazy Plugin Manager: from n/a through 4.1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Eazy Plugin Manager versions up to 4.1.2 contain an authentication flaw that allows a low-privileged user to gain full control of the site. An attacker with basic user access can bypass authentication checks and perform administrative actions including reading sensitive data, modifying site content, and disabling services. The vulnerability affects the entire site scope.

What an attacker can do

03Attacker Capabilities

A low-privileged user can bypass authentication to read sensitive data, modify content, and disable site functions.

Potential impact on your site

04Site Impact

Any registered user can escalate to full administrative control and compromise your entire site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

April 25, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2023-51471 WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerability CVE-2026-6456 Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation CVE-2024-43240 WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerability CVE-2023-51405 WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability CVE-2023-51477 WordPress BuddyBoss Theme theme <= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerability